Services

Cosmetic regulatory services across four markets.

Two layers of support: ongoing mandates that keep you compliant, and project services that get each product to market.

CIG handles cosmetic regulatory compliance for the EU, UK, Switzerland and the US. Our work falls into two layers. Recurring mandates put a named, insured Responsible Person or agent in place and keep your compliance current. Project services deliver the specific documents and notifications a product needs to launch. Most brands use both.

The four markets are four separate legal regimes. The EU works under Regulation (EC) No 1223/2009 and needs an EU-established Responsible Person, a Product Information File, a signed safety report (the CPSR) and a CPNP notification. Great Britain runs its own retained version of that regulation and needs a UK-established Responsible Person plus an SCPN notification through the Office for Product Safety and Standards. Switzerland requires a responsible person with a Swiss address and has no notification portal at all. The US runs MoCRA, which asks for facility registration, annual product listing and, for foreign facilities, a US Agent. A notification or an appointment in one market does nothing for the others. Brands that sell across borders end up managing all four in parallel, which is the work CIG takes on.

CIG cosmetic compliance services, section banner
Layer oneRecurring mandates

Mandates that keep you legally covered.

Continuing roles in each market: we hold the legal responsibility and keep your files current.

Layer twoProject services

Deliverables that get a product market-ready.

One-off documents and filings, ordered per product as you launch.

What each service delivers

The documents, the signatures and the filings.

Each service produces a defined deliverable. Here is what arrives, and who is legally accountable for it.

The safety assessment (CPSR)

The Cosmetic Product Safety Report is the mandatory safety document behind Annex I of Reg. 1223/2009. It has two parts. Part A gathers the safety information: quantitative and qualitative composition, physico-chemical characteristics and stability, microbiological quality including challenge testing, impurities and packaging, and use and exposure data. Part B is the assessment itself. It states the conclusion, the warnings and instructions of use, the reasoning including the Margin of Safety, and the assessor’s name, address, qualification, date and signature.

Part B can only be signed by a qualified safety assessor who holds a university diploma in pharmacy, toxicology, medicine or a similar discipline recognised by an EU Member State. That signature is the point of the whole exercise. A safety report without a qualified signature is not a CPSR. Every report CIG delivers is reviewed and signed by an assessor who meets that standard, and no notification is filed until that signature is in place.

A CPSR prepared in one jurisdiction does not carry over to another. A US safety report, for example, does not satisfy the EU format, so a brand moving from the US to the EU has the assessment redone to the EU standard rather than translated.

The Product Information File (PIF)

The PIF is the technical file the Responsible Person holds and hands to authorities on request. Under Article 11 it contains the product description, the CPSR, the manufacturing method with a statement of Good Manufacturing Practice (ISO 22716), proof of any claimed effect where the claim justifies it, and data on any animal testing. The file is kept for ten years after the last batch of the product was placed on the market. Switzerland applies the same ten-year retention, counted from the last batch.

Notifications

Once the file is ready, the product is notified in the right portal before it goes on sale. In the EU that is the CPNP under Article 13. In Great Britain it is the SCPN, the Submit Cosmetic Product Notification service run by the OPSS. The CPNP is free to use, and the notification carries the product name, category and function, the Responsible Person’s details, the full INCI formulation, label and packaging images, the CPSR reference and the assessor’s details, and the manufacturing country. Only the appointed Responsible Person can legally submit. Switzerland has no notification portal: instead of a filing, the brand holds a self-monitoring dossier that cantonal laboratories can inspect at any time.

Responsible Person and agent mandates

The Responsible Person is a continuing legal role, not a one-off filing. The EU Responsible Person holds the PIF, verifies the CPSR, manages CPNP notifications, reviews labelling and claims, and is the named contact for authorities, including during a recall. The name and address appear on the product label. A non-EU brand cannot be its own EU Responsible Person and appoints a third-party Responsible Person or sets up its own EU entity. The UK role works the same way for Great Britain and must have a genuine UK-established address; PO boxes and mail-forwarding addresses do not qualify. The responsibility stays live for as long as the product is on the market, which is why these mandates renew rather than close.

Who signs, and who is accountable
The CPSR Part B is signed by a qualified safety assessor holding a recognised pharmacy, toxicology or medicine diploma. No exceptions, and no unsigned reports.
The Responsible Person named on the label is the legal contact for authorities in that market. CIG can hold that role for the EU, the UK and Switzerland.
Under MoCRA the Responsible Person is the manufacturer, packer or distributor whose name is on the label, and a foreign facility that must register also designates a US Agent based in the United States.
No notification is filed without human confirmation, and every dossier carries a full record of the decisions behind it.

What we need from you

The inputs that let us start.

Most delays come from missing paperwork, not from the filing itself. Gathering these early keeps a launch on schedule.

Your formulation

The full INCI list with percentages, the manufacturing method, and the finished product specification. The assessor needs the exact composition to calculate the Margin of Safety, so a partial ingredient list is not enough.

Lab and stability data

Stability, microbiological and challenge test results, plus packaging compatibility where relevant. Stability testing runs for months, so this is usually the item that decides the timeline.

Artwork and claims

Label and packaging images and the marketing claims you intend to make. Claims that go beyond cosmetic function, such as treating a skin condition, change how a product is regulated and are flagged before launch.

Manufacturer details

The manufacturing site, its country, and a Good Manufacturing Practice statement against ISO 22716. For MoCRA, the facility handles its own FDA registration while the brand named on the label does the product listing.

Any existing dossiers

Reports, PIFs or notifications you already hold from another market or a previous provider. Where a document meets the target market’s format, it saves work; where it does not, it is redone rather than reused.

Your markets and SKUs

The markets you are entering and the product count. Compliance is per product and per market, so an accurate SKU list is what a fixed quote is built from.

Realistic timelines

How long each step takes.

The filing is quick. The preparation is what sets the calendar, so plan backwards from your launch date.

Once documentation is complete, a CPNP notification typically clears in about two to five business days. The work ahead of that filing is the longer part. Stability testing on a new formulation runs for months, which is why the end-to-end process for a product that still needs lab work is measured in months rather than weeks. A first-time registration attempted without an appointed Responsible Person can stretch further still, because only the Responsible Person can legally submit.

The practical guidance is to appoint the Responsible Person and start the file six to eight weeks before an intended launch, and earlier if the formulation has not been through stability testing yet. Brands that leave compliance to the end miss their launch window, not because the paperwork is slow, but because the testing behind it cannot be rushed.

Timing at a glance
CPNP notification, once the file is ready: about two to five business days.
Recommended head start before launch: six to eight weeks, more if stability testing is still pending.
Stability testing on a new formulation: months, and it cannot be compressed.
MoCRA facilities renew registration every two years, and each facility’s renewal falls on the anniversary of its own initial registration, not a single shared date.

Edge cases and higher scope

Products that need extra steps.

Some products carry obligations beyond the standard file. These are the ones that catch brands out.

Nanomaterials

A cosmetic that contains a nanomaterial needs a separate notification under Article 16 of Reg. 1223/2009, in addition to the standard CPNP notification. This is a distinct filing with its own information requirements, and it is easy to miss because the standard notification looks complete without it.

Baby, child and higher-scope products

Products for babies and children, and certain other categories such as hair dyes and permanent-wave products, sit at a higher assessment scope. The safety assessment carries more work, and the CPSR fee reflects that rather than a flat per-product figure. These categories are identified at the quoting stage so the scope is clear before work begins.

Drug claims

A claim that a product treats a condition, such as repairing the skin barrier or reducing inflammation, can reclassify it out of cosmetic rules and into stricter drug rules, and has drawn regulatory warning letters. The label and claims review catches this before it becomes a problem on a live listing.

Northern Ireland and Switzerland

Under the Windsor Framework the Northern Ireland market still follows EU Reg. 1223/2009, so it aligns with the EU Responsible Person and CPNP route rather than the Great Britain route. Switzerland is separate again: an EU Responsible Person does not cover it, and if no Swiss-address responsible person is appointed, the company’s chief executive becomes the responsible person by default. Warnings and instructions on Swiss labels must appear in at least one official Swiss language, which is German, French or Italian.

The MoCRA small-business line

A US small business, defined as one with average annual US cosmetic sales under one million dollars over the previous three years, is exempt from facility registration and product listing. The exemption is all or nothing: it is voided if even one product regularly contacts the mucous membrane of the eye, is injected, is for internal use, or alters appearance for more than 24 hours. A single eye product can remove it. Adverse-event reporting and safety substantiation still apply to every brand, exempt or not.

Why both layers

Mandates and projects, joined up.

A single brand selling internationally needs all four markets covered and every product documented. Buying these separately, in each country, is where mistakes and gaps appear. CIG joins them up: the mandates keep you legally present in each market, and the project services keep each product compliant within it.

FAQ

Service questions, answered.

The questions brands ask most often before they start.

The safety report is per product. Each formulation is assessed on its own composition and exposure, so a range of scents or colours built on different formulas each needs its own CPSR. Where products share an identical formula and differ only in a way that does not affect safety, the assessor confirms whether one assessment can cover them. That is a case-by-case judgement made at the quoting stage, not an assumption.

The Part B safety assessment is signed by a qualified safety assessor who holds a university diploma in pharmacy, toxicology, medicine or a similar discipline recognised by an EU Member State. That signature, with the assessor’s name, address, qualification and date, is what makes the document a valid CPSR. CIG prepares the report and a qualified assessor reviews and signs it. No report ships unsigned.

A US report does not transfer to the EU format. The EU CPSR follows Annex I of Reg. 1223/2009 and requires a specific structure, data set and a qualified assessor’s signature. Existing data such as stability and challenge test results can feed the new assessment, but the safety report itself is prepared and signed to the EU standard rather than translated across.

No. CPNP and SCPN are separate systems that do not share data. A product sold in both the EU and Great Britain needs a CPNP notification and an EU Responsible Person for the EU, and an SCPN notification through the OPSS with a UK-established Responsible Person for Great Britain. One notification, and one Responsible Person, does not cover both.

Switzerland needs its own responsible person with an address on Swiss territory. An EU Responsible Person does not cover the Swiss market, and the obligation cannot be delegated to anyone based abroad. If no Swiss-address responsible person is appointed, the company’s chief executive becomes the responsible person by default. CIG can hold the Swiss role for you.

Yes. A cosmetic containing a nanomaterial needs a separate notification under Article 16 of Reg. 1223/2009, on top of the standard CPNP notification. It is a distinct filing with its own requirements. We flag nanomaterials at the quoting stage so the extra step is planned rather than discovered later.

In the EU and the UK there is no small-business exemption and no turnover threshold. A hobbyist selling a few bars of soap faces the same Responsible Person, PIF and CPSR requirement as a large company. The US is different: MoCRA exempts a small business under one million dollars in average annual US cosmetic sales from facility registration and product listing, but that exemption is voided by any product that contacts the eye’s mucous membrane, is injected, is for internal use, or alters appearance for more than 24 hours. Adverse-event reporting and safety substantiation still apply to everyone.

A CPNP notification typically clears in about two to five business days once the file is complete. The preparation ahead of it is the longer part, mainly because stability testing on a new formulation runs for months. We recommend appointing the Responsible Person and starting the file six to eight weeks before launch, and earlier if stability testing is still pending.

Yes. A new Responsible Person can take over existing CPNP and SCPN accounts and manage future updates, so you do not re-audit your whole portfolio or lose your notifications. The change is planned so coverage continues without a gap. Tell us which markets and products are affected and we set out the steps before anything moves.

No. The FDA does not approve cosmetic products before they go on the market. MoCRA requires the Responsible Person to register the facility and list each product, and there is no FDA fee to do either. Listing records the product with the FDA; it is not an approval or endorsement.

Ready to sell in more markets?

Tell us your products and the markets you are entering. You will receive a fixed quote and a clear path to compliance.

In practice

Compliance, in the real world.

A full compliance workflow mapped on a wallSigned safety report handed to a founderA multi-market product portfolio on a shelf